PT-2020-3979 · Microsoft · Dynamics 365

Published 2020-08-09 · Updated 2023-12-31 · CVE-2020-16858

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 (on-premises) (affected versions not specified)

Description: A cross-site scripting issue exists due to insufficient protection of the web page structure. This could allow a remote attacker to perform cross-site scripting attacks using a specially crafted request. The attacker could then run scripts in the security context of the current authenticated user, potentially allowing them to read unauthorized content, take actions on behalf of the user, such as changing permissions and deleting content, and inject malicious content into the user's browser.

Recommendations: For Microsoft Dynamics 365 (on-premises), apply the security update that addresses the vulnerability by ensuring Dynamics Server properly sanitizes web requests. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Fix

Spoofing

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-04373

CVE-2020-16858

Affected Products

Dynamics 365

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-16858 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16858 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16858 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04373 · Security Note